Computer Blue Screens With Mup_File_System Error When Opening Office Documents

Products

• Carbon Black Cloud Endpoint Standard
• Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)
• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)

Issue/Introduction

With the 4.0.2 CBC sensor an endpoint may get a BSOD when opening an office file from a network drive

Environment

• Carbon Black Cloud Windows Sensor: 4.0.2

Cause

Known issue with the 4.0.2 sensor causes a BSOD

Resolution

• Upgrade to 4.0.3 and Higher where this is fixed
• Downgrade to 4.0.1 or below
• Reach out to support for backend config change which can prevent this issue

Additional Information

The following local config change can be used to confirm this is the same issue

• In an elevated command prompt run the following: 

  "c:\program files\confer\repcli" unlock <uninstall-code>
  "c:\program files\confer\repcli" configprops EnableMviFileCopy=0

• If the change no longer occurs with the above change then it is the same issue. NOTE the above change will not survive a reboot. 
• Windows 11 24H2 is only supported on the 4.0.2 and Higher sensor